Opting out of university data sharing

Short answer

For the core statutory reporting, no, you generally cannot opt out. Your university is legally required to report certain data about you to bodies such as the Higher Education Statistics Agency (HESA, now part of Jisc) and the Office for Students (OfS), and in some cases the Education and Skills Funding Agency (ESFA), the Student Loans Company, and the relevant funding and regulatory bodies. Because that sharing rests on legal obligation and public task rather than your consent, you have no free-standing right to refuse it. Some specific, non-statutory uses of your data, such as the Graduate Outcomes survey and marketing or alumni communications, are different and you can usually opt out of those.

Why you cannot generally opt out

Data protection law does not give you a right to stop all processing of your personal data. Under the UK GDPR, an organisation must identify a lawful basis for processing. The right to object under Article 21, and the right to erasure under Article 17, only bite in relation to certain lawful bases, principally consent, legitimate interests, and public task. They do not apply where the processing is necessary to comply with a legal obligation.

Universities typically rely on two lawful bases for statutory returns:

Article 6(1)(c), processing necessary for compliance with a legal obligation. Higher education providers registered with the OfS are required, as an ongoing condition of registration, to provide data to the OfS and its designated data body. HESA data returns are made under this framework.

Article 6(1)(e), processing necessary for the performance of a task carried out in the public interest, which covers the regulation and funding of higher education.

The right to erasure does not apply to processing needed to comply with a legal obligation. The right to object under Article 21 does apply to public task processing, but the university can refuse the objection where it demonstrates compelling legitimate grounds, and compliance with the statutory regulatory framework is exactly that. In practice, therefore, an objection to the mandatory HESA or OfS return would not succeed.

What data is actually shared, and with whom

The categories are usually limited to what the statutory bodies require, for example your student record details, course, qualifications, entry route, mode of study, some demographic and equality monitoring fields, and outcomes. Onward recipients can include the OfS, HESA/Jisc, the ESFA for further education and apprenticeship students, the Student Loans Company where you have funding, and other government departments and agencies that need the data for statutory functions.

Some fields, particularly equality monitoring data on ethnicity, disability, sexual orientation and religion, are special category data. Where these are collected and returned, providers rely on additional conditions under Article 9, commonly the substantial public interest condition in the Data Protection Act 2018 (for example equality of opportunity or treatment). Even here, the collection is generally not consent-based, although in practice you are often not compelled to declare, and you can select “prefer not to say” for many of these fields.

What you can usually opt out of

The picture is different for uses of your data that are not part of the mandatory statutory return.

Graduate Outcomes survey. Your contact details are passed to HESA or its survey contractor for the Graduate Outcomes survey, usually around 15 months after you graduate. You can decline to take part when invited, and the contractor deletes your contact details when the survey closes.

Research and further contact. Where HESA or third parties want to use data beyond the statutory purpose, there are often opt-outs or objection routes.

Marketing, alumni relations and fundraising. These normally rest on consent or legitimate interests, so you can object or withdraw at any time.

You should check your university’s own student privacy notice and HESA’s data collection notices, which set out precisely what is shared, on what lawful basis, and which elements carry an opt-out.

Consequences of trying to refuse the core data

Because supplying accurate data is bound up with your registration and the university’s regulatory obligations, refusing to provide required information can have practical consequences. A university may be unable to complete your enrolment, administer your funding, confer your award, or meet its own conditions of registration. This is why privacy notices typically state that the data is a statutory requirement and that services cannot be delivered without it.

Practical steps if you have concerns

1. Read your university’s student privacy notice and the HESA data collection notices to see exactly what is shared and identify any elements that do carry a genuine opt-out.

2. Distinguish mandatory statutory returns, which you cannot stop, from optional uses such as surveys, research participation, alumni contact and marketing, which you can decline or object to.

3. For equality monitoring fields, use “prefer not to say” where offered if you do not wish to disclose that information.

4. If you object to a specific non-statutory use, put your objection in writing to the university’s data protection officer, whose contact details will be in the privacy notice.

5. If you believe your data is being shared unlawfully, or beyond what the law requires, you can raise it with the DPO, and if unresolved complain to the Information Commissioner’s Office. Be aware, though, that the ICO is very unlikely to uphold a complaint about lawful statutory reporting to the OfS or HESA.

Bottom line

You cannot opt out of the mandatory reporting of your data to HESA, the OfS and the other statutory bodies, because that sharing is grounded in legal obligation and public task rather than consent, and the rights to object and to erasure do not override a statutory duty. You can, however, opt out of or object to non-statutory uses such as the Graduate Outcomes survey, research participation, and marketing or alumni communications, and you can decline to disclose optional equality monitoring information. Checking your own institution’s privacy notice is the quickest way to see which category any particular use falls into.